nixos-configuration/machines/t470s/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports =
    [
      ./hardware-configuration.nix
      ../../hardware/t470s.nix
      ../../sway.nix
      ../../unstable.nix
      ../../fish.nix
      ../../autologin.nix
      ../../lxc.nix
      ../../obs.nix
    ];

  # Use the GRUB 2 boot loader.
  boot = {
    loader = {
      systemd-boot.enable = true;
      efi.efiSysMountPoint = "/boot";
      efi.canTouchEfiVariables = true;
    };
    initrd = {
      availableKernelModules = [
        "aes_x86_64"
        "aesni_intel"
        "cryptd"
      ];
      luks.devices = {
        pvcrypt = {
          device = "/dev/disk/by-uuid/edd860f1-13e5-4301-bfb9-58d0b0bd1c74";
          preLVM = true;
        };
      };
    };
  };

  networking = {
    hostName = "mercury";
    interfaces.enp0s31f6.useDHCP = true;
    networkmanager.enable = true;
    useDHCP = false;
  };

  i18n.defaultLocale = "de_DE.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    keyMap = "neo";
  };

  time.timeZone = "Europe/Berlin";

  environment.systemPackages = with pkgs; [
    file
    firefox-wayland
    fzf
    git
    htop
    ike
    jq
    neovim
    pavucontrol
    redir
    ripgrep
    spice-gtk
    tcpdump
    usbutils
    virt-manager
  ];

  fonts.fonts = with pkgs; [
    powerline-fonts
    roboto
    font-awesome
  ];

  environment.variables.EDITOR = "nvim";

  nixpkgs.overlays = [
    (self: super: {
      neovim = super.neovim.override {
        viAlias = true;
        vimAlias = true;
      };
    })
  ];

  programs.mtr.enable = true;
  
  programs.gnupg.agent = {
     enable = true;
     pinentryFlavor = "qt";
  };

  sound.enable = true;
  hardware.pulseaudio.enable = true;
  hardware.pulseaudio.extraModules = [ pkgs.pulseaudio-modules-bt ];

  hardware.bluetooth.enable = true;
  services.blueman.enable = true;
  services.ofono.enable = true;

  services.udisks2.enable = true;
  
  services.openssh.enable = true;


  virtualisation = {
    docker.enable = true;
    libvirtd.enable = true;
  };

  # https://github.com/NixOS/nixpkgs/issues/60594
  security.wrappers.spice-client-glib-usb-acl-helper.source = "${pkgs.spice-gtk}/bin/spice-client-glib-usb-acl-helper";

  security.polkit.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.jal = {
    isNormalUser = true;
    extraGroups = [
      "dialout"
      "docker"
      "libvirtd"
      "networkmanager"
      "video"
      "wheel"
    ]; # Enable ‘sudo’ for the user.
    shell = pkgs.fish;
  };

  autologin.username = "jal";

  networking.wg-quick.interfaces.wgawsjal = {
    address = [ "10.254.254.6/30" ];
    privateKeyFile = "/root/wireguard-keys/wgawsjal";
    listenPort = 33580;
    #mtu = 1419
    #mtu = 1408
    mtu = 1358;

    peers = [
      {
        publicKey = "5B5Ad+C05saQZaVXw7nc9/htshzcPV5Suj2I8P4Ndik=";
        endpoint = "3.121.44.55:2048";
        persistentKeepalive = 10;
        allowedIPs = [
          "10.254.254.4/30" # tunnel transport
          "10.10.7.0/24"    # NETWAYS
          "10.158.128.0/23" # Approvals (instance.tradebyte.com)
          "10.158.240.0/20" # TB.Shift development
          "10.18.0.0/16"    # AWS IT
          "10.250.0.0/16"   # AWS CCS
          #10.10.7.6/32
          #10.10.7.52/32
          #10.10.7.218/32
          #10.10.7.248/32
        ];
      }
    ];
  };
  networking.firewall.allowedUDPPorts = [
    33580 # wireguard
  ];

  services.dnsmasq = {
    enable = true;
    resolveLocalQueries = true;
    servers = [
      "194.150.168.168" # dns.as250.net Berlin/Frankfurt
      "195.160.173.53" # dnscache.berlin.ccc.de
      "46.182.19.48" # digitalcourage
      "/sv.tb/192.168.99.17"
      "/abc.tb/192.168.99.44"
      "/sys.tradebyte.com/10.10.7.64"
      "/core.tradebyte.com/10.10.7.64"
      "/corp.ad.zalando.net/10.160.19.100"
      "/7.10.10.in-addr.arpa/10.10.7.64"
    ];
    extraConfig = ''
      interface=lo
      listen-address=::1
      listen-address=127.0.0.1
      bind-interfaces
    '';
  };



  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "20.03"; # Did you read the comment?

}